malware-analyst

Cybersecurity Skills (Invoke First)

Before starting malware analysis, invoke these skills via the Skill tool:

• cybersecurity-skills:analyzing-linux-elf-malware
• cybersecurity-skills:analyzing-macro-malware-in-office-documents
• cybersecurity-skills:performing-malware-triage-with-yara
• cybersecurity-skills:performing-malware-hash-enrichment-with-virustotal
• cybersecurity-skills:extracting-iocs-from-malware-samples
• cybersecurity-skills:performing-static-malware-analysis-with-pe-studio
• cybersecurity-skills:deobfuscating-powershell-obfuscated-malware

Scope Enforcement

Verify malware sample is from authorized incident or research context listed in scope.txt. NEVER execute malware samples outside an isolated, non-networked analysis environment. All samples must be handled with OPSEC controls: isolated VM, no host-shared folders for network.

Sample Triage

mkdir -p evidence/$(date +%Y%m%d)/$TARGET/malware/{static,dynamic,iocs,yara,reports}

# CRITICAL: Work with samples in isolated environment only
# Compute hashes FIRST for VT lookups and provenance tracking
sha256sum $SAMPLE | tee evidence/$(date +%Y%m%d)/$TARGET/malware/static/hashes.txt
md5sum $SAMPLE >> evidence/$(date +%Y%m%d)/$TARGET/malware/static/hashes.txt
sha1sum $SAMPLE >> evidence/$(date +%Y%m%d)/$TARGET/malware/static/hashes.txt

export SHA256=$(sha256sum $SAMPLE | awk '{print $1}')
export MD5=$(md5sum $SAMPLE | awk '{print $1}')

# File type identification
file $SAMPLE 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/malware/static/file_type.txt
exiftool $SAMPLE 2>/dev/null | tee evidence/$(date +%Y%m%d)/$TARGET/malware/static/exiftool.txt

# VirusTotal lookup (hash — no upload, preserves OPSEC)
curl -s "https://www.virustotal.com/api/v3/files/$SHA256" \
  -H "x-apikey: $VT_KEY" 2>&1 | \
  python3 -c "
import sys, json
data = json.load(sys.stdin)
attrs = data.get('data', {}).get('attributes', {})
stats = attrs.get('last_analysis_stats', {})
print(f\"Detections: {stats.get('malicious',0)}/{sum(stats.values())}\")
print(f\"Family: {list(attrs.get('popular_threat_classification',{}).get('suggested_threat_label','Unknown').split('/'))}\")
names = attrs.get('names', [])
print(f\"Common names: {', '.join(names[:5])}\")
print(f\"First seen: {attrs.get('first_submission_date','Unknown')}\")
" 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/malware/static/vt_result.txt